1816 Commits

• feat(tui): remove Zellij TUI workarounds (#22214)

  ## Why
  
  We added Zellij-specific TUI workarounds because older Zellij behavior
  did not work with Codex's normal terminal model:
  
  - #8555 made `tui.alternate_screen = "auto"` disable alternate screen in
  Zellij so transcript history stayed available.
  - #16578 avoided scroll-region operations in Zellij by emitting raw
  newlines and using a separate composer styling path.
  
  This PR removes both workarounds because the latest Zellij release
  tested locally (`zellij 0.44.1`) works correctly with Codex's standard
  TUI behavior: normal alternate-screen handling, redraw, and history
  insertion.
  
  ## What Changed
  
  - Removed the `InsertHistoryMode::Zellij` path and the Zellij-only
  newline scrollback insertion behavior.
  - Removed cached `is_zellij` state from the TUI and composer.
  - Removed Zellij-specific composer styling, the helper snapshot, and the
  `TerminalInfo::is_zellij()` convenience method that only served this
  workaround.
  - Changed `tui.alternate_screen = "auto"` to use alternate screen for
  Zellij too; `--no-alt-screen` and `tui.alternate_screen = "never"` still
  preserve the inline mode escape hatch.
  - Updated the generated config schema description for
  `tui.alternate_screen`.
  
  ## How to Test
  
  Manual smoke path used with `zellij 0.44.1`:
  
  1. Build and run this branch inside a Zellij `0.44.1` session with
  default config.
  2. Start Codex normally and produce enough assistant/tool output to
  create scrollback.
  3. Confirm the transcript remains readable, the composer renders
  normally, and scrolling through terminal history works.
  4. Resize the Zellij pane while output exists and confirm the TUI
  redraws without duplicated, missing, or stale rows.
  5. Compare with `--no-alt-screen` or `-c tui.alternate_screen=never` if
  you want to verify the inline fallback still works.
  
  Targeted tests:
  - `just write-config-schema`
  - `just fmt`
  - `just fix -p codex-tui`
  - `cargo test -p codex-terminal-detection`
  - `cargo test -p codex-tui alternate_screen_auto_uses_alt_screen`
  
  Attempted but did not complete locally:
  - `cargo test -p codex-tui` built and ran the new test successfully,
  then failed later on unrelated local failures in
  `status_permissions_full_disk_managed_*` and a stack overflow in
  `tests::fork_last_filters_latest_session_by_cwd_unless_show_all`.
  
  ## Documentation
  
  No developers.openai.com Codex documentation update is needed for this
  revert.

  Felipe Coury · 2026-05-13 12:11:15 -03:00
  6f77b70ff3
• add --dangerously-bypass-hook-trust CLI flag (#21768)

  # Why
  
  Hook trust happens through the TUI in `/hooks` so it can block
  non-interactive use cases. This flag will allow users that are using
  codex headlessly to bypass hooks when they want to.
  
  # What
  
  This adds one invocation-scoped escape hatch.
  
  - the CLI flag sets a runtime-only `bypass_hook_trust` override; there
  is no durable `config.toml` setting
  - hook discovery still respects normal enablement, so explicitly
  disabled hooks remain disabled
  - we show a `--dangerously-bypass-hook-trust is enabled. Enabled hooks
  may run without review for this invocation.` message on startup so
  accidental use is visible in both interactive and exec flows
  
  This keeps “enabled” and “trusted” as separate concepts in the normal
  path, while giving CI/E2E callers a stable way to opt into the
  exceptional path when they already control the hook set.

  Abhinav · 2026-05-13 07:13:57 +00:00
  392e94e9ea
• Refactor chatwidget input flow into modules (#22407)

  ## Why
  
  `chatwidget.rs` is still carrying too many unrelated responsibilities in
  one file. #22269 started a five-phase effort to move coherent behavior
  domains into focused modules while keeping `chatwidget.rs` as the
  composition layer.
  
  This PR is phase 2 of that plan. It extracts the input and submission
  flow as a mechanical move before the later protocol, popup/status, and
  constructor/orchestration phases.
  
  ## What Changed
  
  - Added `codex-rs/tui/src/chatwidget/input_flow.rs` for composer input
  results, queued user-message draining, pending-input previews, and
  mode-specific submission entry points.
  - Added `codex-rs/tui/src/chatwidget/input_submission.rs` for
  user-message construction/submission, shell prompt submission,
  structured mention resolution, and blocked image draft restoration.
  - Added `codex-rs/tui/src/chatwidget/input_restore.rs` for
  initial-message submission, pending steer restoration after interrupts,
  and thread input snapshot/restore behavior.
  - Registered the new modules and removed the moved `ChatWidget` impl
  methods from `codex-rs/tui/src/chatwidget.rs`.
  
  ## Follow-On Refactor Phases
  
  The five-phase plan from #22269 is:
  
  - Phase 1: mechanical helper and state moves. Completed in #22269.
  - Phase 2: extract input and submission flow, including queued user
  messages, shell prompt submission, pending steer restoration, and thread
  input snapshot/restore behavior. This PR.
  - Phase 3: extract protocol, replay, streaming, and tool lifecycle
  handling, while preserving active-cell grouping, transcript
  invalidation, interrupt deferral, and final-message separator behavior.
  - Phase 4: extract settings, popups, and status surfaces, including
  model/reasoning/collaboration/personality popups, permission prompts,
  rate-limit UI, and connectors helpers.
  - Phase 5: clean up the remaining constructor and orchestration code
  once the larger behavior domains have moved out, leaving `chatwidget.rs`
  as the composition layer.

  Eric Traut · 2026-05-12 21:17:35 -07:00
  2630a6ca35
• Add support for UDS in codex --remote (#22414)

  ## Why
  
  Added support for UDS connections in `codex --remote`.
  
  TUI also now connects to local app-server using UDS by default if it is
  running and set to listen to UDS connection.
  
  ## What Changed
  
  - Introduced `RemoteAppServerEndpoint` with `WebSocket` and `UnixSocket`
  variants.
  - Reused the existing JSON-RPC-over-WebSocket protocol over either a TCP
  WebSocket stream or a UDS stream.
  - Updated `codex --remote` to accept `ws://host:port`,
  `wss://host:port`, `unix://`, and `unix://PATH`.
  - Kept `--remote-auth-token-env` restricted to `wss://` and loopback
  `ws://` remotes.
  - Added a fast TUI startup probe for the default daemon socket, falling
  back to the embedded app server when the daemon is absent or
  unresponsive.
  
  ## Verification
  
  - Manually verified that the updated remote flow works.
  - Added coverage for UDS remote round trips, WebSocket auth headers,
  auth-token transport policy, remote address parsing, and missing-daemon
  fallback.
  - Ran focused remote test coverage locally.

  Eric Traut · 2026-05-12 21:17:20 -07:00
  ad572709ab
• Remove CODEX_RS_SSE_FIXTURE test hook (#22413)

  ## Why
  
  `CODEX_RS_SSE_FIXTURE` let integration-style CLI, exec, and TUI tests
  bypass the normal Responses transport by reading SSE from local files.
  That kept test-only behavior wired through production client code. The
  affected tests can stay hermetic by using the existing
  `core_test_support::responses` mock server and passing `openai_base_url`
  instead.
  
  ## What Changed
  
  - Removed the `CODEX_RS_SSE_FIXTURE` flag,
  `codex_api::stream_from_fixture`, the `env-flags` dependency, and the
  checked-in SSE fixture files.
  - Repointed the affected core, exec, and TUI tests at `MockServer` with
  the existing SSE event constructors.
  - Removed the Bazel test data plumbing for the deleted fixtures and
  refreshed cargo/Bazel lock state.
  
  ## Verification
  
  - `cargo build -p codex-cli`
  - `cargo test -p codex-api`
  - `cargo test -p codex-core --test all responses_api_stream_cli`
  - `cargo test -p codex-core --test all
  integration_creates_and_checks_session_file`
  - `cargo test -p codex-exec --test all ephemeral`
  - `cargo test -p codex-exec --test all resume`
  - `cargo test -p codex-tui --test all
  resume_startup_does_not_consume_model_availability_nux_count`
  - `just bazel-lock-update`
  - `just bazel-lock-check`
  - `just fix -p codex-api -p codex-core -p codex-exec -p codex-tui`
  - `git diff --check`

  pakrym-oai · 2026-05-13 03:08:01 +00:00
  96833c5b15
• Add allow_managed_hooks_only hook requirement (#20319)

  ## Why
  
  Enterprise-managed hook policy needs a narrow way to require Codex to
  ignore user-controlled lifecycle hooks without adopting the broader
  trust-precedence model from earlier hook work. This keeps the policy
  anchored in `requirements.toml`, so admins can opt into managed hooks
  only while normal `config.toml` files cannot enable the restriction
  themselves.
  
  ## What changed
  
  - Added `allow_managed_hooks_only` to the requirements data flow and
  preserved explicit `false` values.
  - Also adds it to /debug-config
  - Marked MDM, system, and legacy managed config layers as managed for
  hook discovery.
  - Updated hook discovery so `allow_managed_hooks_only = true`:
    - keeps managed requirements hooks and managed config-layer hooks,
  - skips user/project/session `hooks.json` and `[hooks]` entries with
  concise startup warnings,
    - skips current unmanaged plugin hooks,
  - ignores any `allow_managed_hooks_only` key placed in ordinary
  `config.toml` layers.

  Andrei Eternal · 2026-05-12 19:05:25 -07:00
  913aad4d3c
• feat: Expose plugin versions and gate plugin sharing (#22397)

  - Adds localVersion to plugin summaries and remoteVersion to share
  context, including generated API schemas.
  - Hydrates local and remote plugin versions from manifests and remote
  release metadata.
  - Adds default-on plugin_sharing gate for shared-with-me listing and
  plugin/share/save, with disabled-path errors
      and focused coverage.

  xl-openai · 2026-05-12 17:56:30 -07:00
  d1430fd61e
• Refactor chatwidget state into modules (#22269)

  ## Why
  
  `chatwidget.rs` is still carrying too many unrelated responsibilities in
  one file. After #21866 consolidated some of the state it tracks, this
  starts the next phase by moving coherent state/helper clusters out of
  the main module without changing behavior.
  
  This PR is intentionally mechanical: it only moves existing functions,
  structs, and helpers into focused modules so the boundaries are easier
  to review before the less mechanical refactors that should follow.
  
  ## What Changed
  
  - Moved user-message, composer, queue, pending steer, and merge/remap
  helpers into `codex-rs/tui/src/chatwidget/user_messages.rs`.
  - Added `codex-rs/tui/src/chatwidget/exec_state.rs` for unified exec
  bookkeeping helpers.
  - Added `codex-rs/tui/src/chatwidget/rate_limits.rs` for rate-limit
  warning, prompt, and error classification state.
  - Moved plugin list fetch and install auth-flow state into
  `codex-rs/tui/src/chatwidget/plugins.rs`.
  - Made a couple of test-only `VecDeque` imports explicit now that those
  tests no longer inherit the parent module import.
  
  ## Verification
  
  - `cargo test -p codex-tui` was run
  
  ## Follow-On Refactor Phases
  
  This PR is phase 1: mechanical helper and state moves. Planned follow-up
  PRs:
  
  - Phase 2: extract input and submission flow, including queued user
  messages, shell prompt submission, pending steer restoration, and thread
  input snapshot/restore behavior.
  - Phase 3: extract protocol, replay, streaming, and tool lifecycle
  handling, while preserving active-cell grouping, transcript
  invalidation, interrupt deferral, and final-message separator behavior.
  - Phase 4: extract settings, popups, and status surfaces, including
  model/reasoning/collaboration/personality popups, permission prompts,
  rate-limit UI, and connectors helpers.
  - Phase 5: clean up the remaining constructor and orchestration code
  once the larger behavior domains have moved out, leaving `chatwidget.rs`
  as the composition layer.

  Eric Traut · 2026-05-12 17:33:33 -07:00
  92930a8d40
• [codex] Remove workspace owner usage nudge gate (#20509)

  ## Summary
  - make workspace owner nudge handling unconditional in the TUI now that
  it is fully rolled out
  - keep `workspace_owner_usage_nudge` as a removed no-op compatibility
  flag so old configs/app overrides remain accepted during rollout
  - remove flag-disabled test setup
  
  ## Companion PR
  - https://github.com/openai/openai/pull/876351 removes the Codex Apps
  Statsig rollout gate override after this change is available to the
  app/runtime path
  
  ## Validation
  - `just write-config-schema`
  - `just fmt`
  - `cargo test -p codex-features`
  - `cargo test -p codex-tui status_and_layout`

  richardopenai · 2026-05-12 17:07:33 -07:00
  b6e718591b
• test(tui): relax configured pet load timeout (#22392)

  ## Why
  
  Windows CI has been timing out in
  `configured_pet_load_is_deferred_until_after_construction` while waiting
  for the deferred configured-pet load event.
  
  The test still needs to prove construction returns before the pet image
  is available, but the background load slices the built-in pet
  spritesheet into frame cache files. That work can exceed the old 2
  second deadline on slower or more contended CI machines.
  
  ## What Changed
  
  - Increased the test wait for `ConfiguredPetLoaded` from 2 seconds to 30
  seconds.
  - Kept the post-construction assertion intact so the test still verifies
  that the pet is not loaded synchronously during `ChatWidget`
  construction.
  
  ## How to Test
  
  Targeted tests:
  - `cargo test -p codex-tui
  configured_pet_load_is_deferred_until_after_construction`
  - `just argument-comment-lint`
  
  Additional check:
  - `cargo test -p codex-tui` was run, but the broader crate suite did not
  complete successfully due to unrelated existing failures:
  -
  `status::tests::status_permissions_full_disk_managed_without_network_is_external_sandbox`
  -
  `status::tests::status_permissions_full_disk_managed_with_network_is_danger_full_access`
  - later abort in
  `tests::fork_last_filters_latest_session_by_cwd_unless_show_all` from
  stack overflow

  Felipe Coury · 2026-05-12 16:50:35 -07:00
  6dc3b3d7c8
• code-mode: carry nested tool kind through runtime (#22377)

  ## Why
  
  Code mode only used nested spec lookup at execution time to rediscover
  whether a nested tool should be invoked as a function tool or a freeform
  tool.
  
  That information is already present in the enabled tool metadata that
  code mode builds to expose `tools.*` and `ALL_TOOLS`, so re-looking it
  up from the router was redundant and kept execution coupled to a
  separate spec lookup path.
  
  ## What Changed
  
  - thread `CodeModeToolKind` through the code-mode runtime `ToolCall`
  event and `CodeModeNestedToolCall`
  - emit the nested tool kind directly from the V8 callback using the
  already-enabled tool metadata
  - build nested tool payloads from the propagated kind instead of calling
  `find_spec`
  - remove the now-unused `find_spec` plumbing from the router and
  parallel runtime helpers
  - add unit coverage for function vs freeform payload shaping and update
  affected router tests
  
  ## Testing
  
  - `cargo test -p codex-code-mode`
  - `cargo test -p codex-core code_mode::tests`
  - `cargo test -p codex-core
  extension_tool_bundles_are_model_visible_and_dispatchable`
  - `cargo test -p codex-core
  model_visible_specs_filter_deferred_dynamic_tools`

  pakrym-oai · 2026-05-12 23:34:37 +00:00
  960d42ddae
• feat(tui): add ambient terminal pets (#21206)

  ## Why
  
  The Codex App has animated pets, but the TUI had no equivalent ambient
  companion surface. This brings that experience into terminal Codex while
  keeping the main chat flow usable: the pet should feel present, but it
  cannot cover transcript text, composer input, approvals, or picker
  content.
  
  The feature also needs to be terminal-aware. Different terminals support
  different image protocols, tmux can interfere with image rendering, and
  some users will want pets disabled entirely or anchored differently
  depending on their layout.
  
  <table>
  <tr><td>
  <img width="4110" height="2584" alt="CleanShot 2026-05-05 at 12 41
  45@2x"
  src="https://github.com/user-attachments/assets/68a1fcbc-2104-48d6-b834-69c6aaa95cdf"
  />
  <p align="center">macOS - Ghostty, iTerm2 and WezTerm with Custom
  Pet</p>
  </td></tr>
  <tr><td>
  ![Uploading CleanShot 2026-05-10 at 20.28.30.png…]()
  <p align="center">Windows Terminal</p>
  </td></tr>
  <tr><td>
  <img width="3902" height="2752" alt="CleanShot 2026-05-05 at 12 39
  02@2x"
  src="https://github.com/user-attachments/assets/300e2931-6b00-467e-91cb-ab8e28470500"
  />
  <p align="center">Linux - WezTerm and Ghostty</p>
  </td></tr>
  </table>
  
  ## What Changed
  
  - Add a TUI ambient pet renderer in `codex-rs/tui/src/pets/`.
  - Port the app-style pet animation states so the sprite changes with
  task status, waiting-for-input states, review/ready states, and
  failures.
  - Add `/pets` selection UI with a preview pane, loading state, built-in
  pet choices, and a first-row `Disable terminal pets` option.
  - Download built-in pet spritesheets on demand from the same public CDN
  path already used by Android, under
  `https://persistent.oaistatic.com/codex/pets/v1/...`, and cache them
  locally under `~/.codex/cache/tui-pets/`.
  - Keep custom pets local.
  - Add config support for pet selection, disabling pets, and choosing
  whether the pet follows the composer bottom or anchors to the terminal
  bottom.
  - Reserve layout space around the pet so transcript wrapping, live
  responses, and composer input do not render underneath the sprite.
  - Gate image rendering by terminal capability, disable image pets under
  tmux, and support both Kitty Graphics and SIXEL terminals.
  - Add redraw cleanup for terminal image artifacts, including sixel cell
  clearing.
  
  ## Current Scope
  
  - This is an initial TUI version of ambient pets, not full App parity.
  - It focuses on ambient sprite rendering, `/pets` selection, custom
  pets, terminal capability gating, and on-demand CDN-backed built-in
  assets.
  - The ambient text overlay is currently disabled, so the TUI renders the
  pet sprite without extra status text beside it.
  
  ## How to Test
  
  1. Start Codex TUI in a terminal with image support.
  2. Run `/pets`.
  3. Confirm the picker shows built-in pets plus custom pets, and the
  first item is `Disable terminal pets`.
  4. On a fresh `~/.codex/cache/tui-pets/`, move onto a built-in pet and
  confirm the first preview downloads the spritesheet from the shared
  Codex pets CDN and renders successfully.
  5. Move through the pet list and confirm subsequent built-in previews
  use the local cache.
  6. Select a pet, then send and receive messages. Confirm transcript and
  composer text wrap before the pet instead of rendering underneath the
  sprite.
  7. Change the pet anchor setting and confirm the pet can either follow
  the composer bottom or sit at the terminal bottom.
  8. Return to `/pets`, choose `Disable terminal pets`, and confirm the
  sprite disappears cleanly.
  
  Targeted tests:
  - `cargo test -p codex-tui ambient_pet_`
  - `cargo test -p codex-tui
  resize_reflow_wraps_transcript_early_when_pet_is_enabled`
  - `cargo insta pending-snapshots`

  Felipe Coury · 2026-05-12 10:43:17 -03:00
  95b332c820
• feat: Normalize remote plugin summary identities. (#22265)

  Makes plugin summaries use config-style plugin@marketplace IDs while
  exposing backend remote IDs separately as remotePluginId.
  
  Also fix the consistency issue of REMOTE_SHARED_WITH_ME_MARKETPLACE_NAME

  xl-openai · 2026-05-12 00:58:37 -07:00
  5b1a4c2fa7
• fix(tui): handle hidden app git directives (#21946)
  Felipe Coury · 2026-05-11 21:08:40 -03:00
  e16b4e46d4
• Add Windows hook command overrides (#22159)

  # Why
  
  Managed hook configs need a shared cross-platform shape without making
  the existing `command` field polymorphic. The common case is still one
  command string, with Windows needing a different entrypoint only when
  the runtime is actually Windows.
  
  Keeping `command` as the portable/default path and adding an optional
  Windows override keeps the config easier to read, preserves the existing
  scalar shape for non-Windows users, and avoids forcing every caller into
  a `{ unix, windows }` object when only one platform needs special
  handling.
  
  # What
  
  - Add optional `command_windows` / `commandWindows` alongside the
  existing hook `command` field.
  - Resolve `command_windows` only on Windows during hook discovery; other
  platforms continue to use `command` unchanged.
  - Keep trust hashing aligned to the effective command selected for the
  current runtime.
  
  # Docs
  
  The Codex hooks/config reference should document `command_windows` as
  the Windows-only override for command hooks.

  Abhinav · 2026-05-11 22:22:29 +00:00
  9ab7f4e6ac
• feat(connectors): support managed app tool approval requirements (#21061)

  ## Why
  
  Managed requirements can already centrally disable apps, but they could
  not express the per-tool app approval rules that normal config already
  supports. That left admins without a way to enforce connector tool
  approvals through `/etc/codex/requirements.toml` or cloud requirements.
  
  ## What changed
  
  - Extend app requirements with per-tool `approval_mode` entries.
  - Merge managed app tool requirements across managed sources while
  preserving higher-precedence exact tool settings.
  - Apply managed tool approvals separately from user app config so
  managed policy is matched only on raw MCP `tool.name`, while user config
  keeps the existing raw-name-then-title convenience fallback.
  - Add coverage for local requirements, cloud requirements parsing,
  managed-over-user precedence, and a title-collision case that must not
  widen managed auto-approval.
  
  ## Configuration shape
  
  Local `/etc/codex/requirements.toml` and cloud requirements use the same
  TOML shape:
  
  ```toml
  [apps.connector_123123.tools."calendar/list_events"]
  approval_mode = "approve"
  ```
  
  This is a per-tool approval rule keyed by app ID and raw MCP tool name,
  not an app-level boolean such as `apps.connector_123123.approve = true`.

  viyatb-oai · 2026-05-11 19:08:26 +00:00
  d0fa2d81d8
• Unified mentions in TUI (#19068)

  This PR replaces the TUI’s file-only `@mention` popup with a unified
  mentions experience. Typing `@...` now searches across filesystem
  matches, installed plugins, and skills in one popup, with result types
  clearly labeled and selectable from the same flow.
  
  - Adds a unified `@mentions` popup that returns:
    - plugins
    - skills
    - files
    - directories
  
  - Adds search modes so users can narrow the popup without changing their
  query:
    - All Results _(default/same as Codex App)_
    - Filesystem Only
    - Plugins _(...and skills)_
  
  - Preserves existing insertion behavior:
    - selected file paths are inserted into the prompt
    - paths with spaces are quoted
    - image file selections still attach as images when possible
    - selecting a plugin or skill inserts the corresponding `$name`
  - the composer records the canonical mention binding, such as
  `plugin://...` or the skill path
  
  - Expanded `@mentions` rendering:
    - type tags for Plugin, Skill, File, and Dir
    - distinct plugin/filesystem colors
    - stable fixed-height layout (8 rows)
    - truncation behavior for narrow terminals
  
  Note:
  - The unified mentions popup does not display app connectors under
  `@mention` results for Codex App parity. Connector mentions remain
  available through the existing `$mention` path.
  
  
  https://github.com/user-attachments/assets/f93781ed-57d3-4cb5-9972-675bc5f3ef3f

  canvrno-oai · 2026-05-11 11:34:52 -07:00
  eaf05c9002
• Add process-scoped SQLite telemetry (#22154)

  ## Summary
  - add SQLite init, backfill-gate, and fallback telemetry without
  introducing a cross-cutting state-db access wrapper
  - install one process-scoped telemetry sink after OTEL startup and let
  low-level state/rollout paths emit through it directly
  - add process-start metrics for the process owners that initialize
  SQLite
  
  ---------
  
  Co-authored-by: Owen Lin <owen@openai.com>

  jif-oai · 2026-05-11 11:32:40 -07:00
  b401666ca5
• Fix goal update and add /goal edit command in TUI (#21954)

  ## Why
  
  Users have requested the ability to edit a goal's objective after a goal
  has been created. This PR exposes a new `/goal edit` command in the TUI
  to address this request.
  
  In the process of implementing this, I also noticed an existing bug in
  the goal runtime. When a goal's objective is updated through the
  `thread/goal/set` app server API, the goal runtime didn't emit a new
  steering prompt to tell the agent about the new objective. This PR also
  fixes this hole.
  
  ## What Changed
  
  - Adds `/goal edit` in the TUI, opening an edit box prefilled with the
  current goal objective.
  - Keeps active and paused goals in their current state, resets completed
  goals to active, keeps budget-limited goals budget-limited, and
  preserves the existing token budget.
  - Changes the existing `thread/goal/set` behavior so editing an
  objective preserves goal accounting instead of resetting it. The older
  reset-on-new-objective behavior was left over from before
  `thread/goal/clear`; clients that need to reset accounting can now clear
  the existing goal and create a new one.
  - Reuses the existing goal set API path; this does not add or change
  app-server protocol surface area.
  - Adds a dedicated goal runtime steering prompt when an externally
  persisted goal mutation changes the objective, so active turns receive
  the updated objective.
  
  ## Validation
  
  - Make sure `/goal edit` returns an error if no goal currently exists
  - Make sure `/goal edit` displays an edit box that can be optionally
  canceled with no side effects
  - Make sure that an edited goal results in a steer so the agent starts
  pursuing the new objective
  - Make sure the new objective is reflected in the goal if you use
  `/goal` to display the goal summary
  - Make sure that `/goal edit` doesn't reset the token budget, time/token
  accounting on the updated goal

  Eric Traut · 2026-05-11 10:49:19 -07:00
  1e65b3e0af
• Fix side conversation config inheritance (#22106)

  Addresses #22101
  
  ## Why
  
  Side conversations are ephemeral forks of the active thread, but `/side`
  was building its fork config from the app-level config after refreshing
  it from disk. If the parent thread had runtime settings that differed
  from the current persisted defaults, such as a changed model, reasoning
  effort, permissions, reviewer, or fast-mode selection, the side
  conversation could start with different behavior than its parent.
  
  ## What changed
  
  - Build side fork config from the active parent `ChatWidget` config,
  then overlay the parent thread's effective model, reasoning effort,
  service tier, and fast-mode opt-out state.
  - Forward model reasoning summary, verbosity, personality, web search
  mode, and service-tier overrides through TUI app-server
  start/resume/fork lifecycle params.
  - Add focused tests for parent runtime inheritance, side developer
  guardrail preservation, and lifecycle param forwarding.

  Eric Traut · 2026-05-11 09:47:51 -07:00
  c03eb20d8d
• Persist /goal commands in history (#21860)

  ## Summary
  
  A user reported that `/goal` was not saved to the TUI command history,
  which made it unavailable for later recall even though other accepted
  input paths persist history entries.
  
  This updates the TUI goal slash-command dispatch so successful `/goal`
  invocations append the command text to message history. The change
  covers the bare `/goal` menu command, goal control commands such as
  `/goal pause`, and objective-setting commands such as `/goal improve
  benchmark coverage`.
  
  ## Verification
  
  - `cargo test -p codex-tui goal_slash_command -- --nocapture`

  Eric Traut · 2026-05-11 08:43:55 -07:00
  2229c8daf2
• feat(tui): render responsive Markdown tables in TUI (#22052)

  ## Why
  
  The TUI currently treats Markdown tables as ordinary wrapped text, which
  makes table-heavy responses hard to read and brittle across narrow panes
  and terminal resizes.
  
  This change teaches the TUI to render Markdown tables responsively while
  preserving the raw Markdown source needed to re-render streamed and
  finalized transcript content after width changes. The goal is to keep
  tables legible during streaming, after resize, and once a turn has
  finished, without corrupting scrollback ordering.
  
  ## What Changed
  
  - add table detection and responsive table rendering in the Markdown
  renderer
  - render standard tables with Unicode box-drawing borders when the pane
  is wide enough
  - add a vertical readability fallback for constrained or dense tables so
  narrow panes still show each row clearly
  - keep links and `<br>` content inside table cells instead of leaking
  text outside the table
  - avoid table normalization inside fenced or indented code blocks
  - preserve raw streamed Markdown source and keep the active table as a
  mutable tail until finalization
  - consolidate finalized streamed content into source-backed transcript
  cells so post-resize re-rendering stays correct
  - add snapshot and targeted streaming/resize regression coverage for the
  new table behavior
  
  ## How to Test
  
  1. Start Codex TUI from this branch.
  2. Paste this exact prompt:
  `This is a session to test codex, no need to do any thinking, just end
  different markdown tables, with columns exploring different markdown
  contents, like links, bold italic, code, etc. Make them different sizes,
  some 30+ rows, some not and intertwine them with some paragraphs with
  complex formatting as well.`
  3. Confirm the response includes several Markdown tables mixed with
  richly formatted paragraphs.
  4. Confirm wide-enough tables render with box-drawing borders instead of
  plain wrapped pipe text.
  5. Resize the terminal narrower while the answer is still streaming and
  confirm the in-progress table stays coherent instead of duplicating
  headers or leaving broken scrollback behind.
  6. Resize again after the turn finishes and confirm the finalized
  transcript re-renders cleanly at the new width.
  7. In a narrow pane, verify dense tables fall back to the vertical
  per-row layout instead of producing unreadable wrapped columns.
  8. Also verify pipe-heavy fenced code blocks still render as code, not
  as tables.
  
  Targeted tests:
  - `cargo test -p codex-tui table_readability_fallback --no-fail-fast`
  - `cargo test -p codex-tui markdown_render --no-fail-fast`
  - `cargo test -p codex-tui streaming::controller --no-fail-fast`
  - `cargo test -p codex-tui table_resize_lifecycle --no-fail-fast`
  
  ## Docs
  
  No developer docs update appears necessary.

  Felipe Coury · 2026-05-10 20:42:11 +00:00
  5248e3da2b
• fix(tui): preserve Shift+Enter in tmux csi-u panes (#21943)

  ## Why
  
  Inside tmux, `Shift+Enter` can still reach Codex as a plain `Enter` even
  when tmux has extended keys enabled. In `csi-u` tmux panes, Codex needs
  to request `modifyOtherKeys` mode 2 so tmux moves the pane from `VT10x`
  into extended-key mode and preserves the Shift modifier. Without that
  extra request, composer `Shift+Enter` submits the draft instead of
  inserting a newline.
  
  Fixes #21699.
  
  ## What Changed
  
  - Detect tmux sessions and read the active `extended-keys-format`,
  preferring the pane-local value before falling back to the global
  option.
  - Request `modifyOtherKeys` mode 2 for tmux panes using `csi-u` extended
  keys, and reset it when restoring keyboard reporting.
  - Add unit coverage for tmux detection, the format gate, and the emitted
  `modifyOtherKeys` escape sequence.
  
  ## How to Test
  
  1. In tmux, configure:
     ```tmux
     set-option -g extended-keys on
     set-option -g extended-keys-format csi-u
     ```
  2. Start Codex in a fresh tmux pane from this branch.
  3. From another pane, confirm the Codex pane reports `mode=Ext 2`:
     ```bash
  tmux list-panes -a -F '#{session_name}:#{window_index}.#{pane_index}
  mode=#{pane_key_mode} cmd=#{pane_current_command}'
     ```
  4. Type a draft in the composer and press `Shift+Enter`; confirm it
  inserts a newline instead of submitting.
  5. Also confirm plain `Enter` still submits as before.
  
  Targeted tests:
  - `cargo test -p codex-tui`
  
  ## Notes
  
  - Manual verification used both real `Shift+Enter` in iTerm2/tmux and
  `tmux send-keys ... S-Enter` to confirm the tmux pane changes from
  `VT10x` to `Ext 2` and preserves newline behavior.
  - On this checkout, the broader `codex-tui` test run currently reaches
  unrelated existing failures in `status::tests::*` plus a later stack
  overflow in
  `tests::fork_last_filters_latest_session_by_cwd_unless_show_all`.

  Felipe Coury · 2026-05-10 11:45:49 -03:00
  cac5354455
• Split ChatWidget state into focused modules (#21866)

  ## Summary
  
  `ChatWidget` has been carrying several independent domains in one large
  state bag: transcript bookkeeping, turn lifecycle, queued input, status
  surfaces, connectors, review mode, and protocol dispatch. That makes
  otherwise-local changes hard to reason about because unrelated fields
  and side effects live beside each other in `chatwidget.rs`.
  
  This is the first cleanup PR in a larger decomposition effort. It does
  not try to make `chatwidget.rs` small in one sweep; instead, it
  establishes focused state boundaries that later handler, popup,
  rendering, and effect-synchronization extractions can build on.
  
  This PR keeps `ChatWidget` as the composition layer while moving focused
  state into smaller `codex-tui` modules. The widget still owns effects
  that touch the bottom pane, app events, command submission, redraw
  scheduling, and terminal-title updates.
  
  ## Changes
  
  - Add focused state modules under `codex-rs/tui/src/chatwidget/` for
  input queues, turn lifecycle, transcript bookkeeping, status state,
  connectors, review mode, and app-server protocol dispatch.
  - Update `ChatWidget` to hold grouped state structs and route
  input/lifecycle/status operations through those focused helpers.
  - Move app-server notification dispatch into `chatwidget/protocol.rs`
  while leaving feature handlers and side effects on `ChatWidget`.
  - Replace the large manual `ChatWidget` test literal with the normal
  constructor plus narrow test overrides, so future state moves do not
  require every field to be restated in test setup.
  - Update existing tests to access the new grouped state or narrower
  helpers without changing snapshot behavior.
  
  ## Longer-term direction
  
  Follow-up PRs can continue shrinking `chatwidget.rs` by moving behavior,
  not just state, into focused modules:
  
  - Extract input/submission flow, turn/stream handling, and tool-cell
  lifecycles into domain modules that call the new state reducers.
  - Move popup/settings builders and rendering helpers out of the main
  widget file so `ChatWidget` stays focused on composition.
  - Reduce direct `BottomPane` mutation by applying domain-specific sync
  outputs at clearer boundaries.

  Eric Traut · 2026-05-09 15:16:01 -07:00
  789b7e39dc
• Avoid blocking TUI on agent metadata hydration (#21870)

  ## Why
  
  Fixes #16688.
  
  The TUI currently hydrates collab receiver metadata by awaiting
  `thread/read` before each active-thread notification is rendered. During
  large subagent fan-outs, the embedded app-server can be busy starting
  agents and processing spawn work, so those synchronous metadata reads
  queue behind the fan-out and block the TUI event loop. That makes the UI
  appear frozen even though the underlying agent work can continue.
  
  ## What Changed
  
  - Replaced eager `thread/read` metadata hydration on the active
  notification path with local receiver-thread caching.
  - Kept `ThreadStarted` and picker refreshes as the places that fill in
  agent nickname/role metadata when it is available.
  - Skipped caching receiver threads that are explicitly reported as
  `NotFound`, avoiding live-looking ghost entries for failed stale-agent
  calls.
  - Added TUI tests covering both local receiver caching and `NotFound`
  suppression.
  
  ## Verification
  
  - `cargo test -p codex-tui collab_receiver_notification`
  - `just fix -p codex-tui`
  
  I also ran the full `cargo test -p codex-tui`; the new test passed, but
  the full process later aborted with an unrelated stack overflow in
  `tests::fork_last_filters_latest_session_by_cwd_unless_show_all`.

  Eric Traut · 2026-05-09 15:15:40 -07:00
  90c0bec50c
• Improve hooks trust flow in TUI (#21755)

  # Why
  Hooks that need trust review were easy to miss, and the existing TUI
  flow made users discover `/hooks` manually before they could decide
  whether to inspect or trust them.
  
  # What
  - add a startup review prompt for new or changed hooks before normal
  composer use
  - add a top-level `t` shortcut in `/hooks` to trust every review-needed
  hook at once
  - make pending-review rows and helper copy use warning styling
  
  ## TUI
  
  ### Startup review interstitial
  
  ```text
  Hooks need review
  2 hooks are new or changed.
  Hooks can run outside the sandbox after you trust them.
  
  › 1. Review hooks
    2. Trust all and continue
    3. Continue without trusting (hooks won't run)
  ```
  
  ### Top-level `/hooks` page when review is needed
  
  ```text
  Hooks
  Lifecycle hooks from config and enabled plugins.
  
  ⚠ 1 hook needs review before it can run.
  
  Event                 Installed   Active   Review   Description
  PreToolUse            1           0        1        Before a tool executes
  ...
  
  Press t to trust all; enter to review hooks; esc to close
  ```

  Abhinav · 2026-05-09 21:17:30 +00:00
  6d747db7d8
• fix(tui): improve light-mode selection contrast (#21950)

  ## Why
  
  On light terminal backgrounds, selected rows in several TUI pickers were
  rendered with the same bright cyan accent used on dark themes. Against
  the light menu surface, that made the current selection hard to
  distinguish at a glance.
  
  <table><tr>
  <td>
  <p align="center">Before</p>
  <img width="1109" height="864" alt="SCR-20260509-nmtz"
  src="https://github.com/user-attachments/assets/b31ce0d0-19c2-4bdd-a220-7acc77bd8e8e"
  />
  </td>
  <td>
  <p align="center">After</p>
  <img width="1164" height="844" alt="SCR-20260509-nmox"
  src="https://github.com/user-attachments/assets/7b3fede0-4739-4a9f-a979-cdbb7451841f"
  />
  </td>
  </tr></table>
  
  ## What changed
  
  - Added a shared background-aware accent style for active/selected TUI
  controls.
  - Use a darker cyan-family accent on light backgrounds while preserving
  the existing bright cyan accent on dark or unknown backgrounds.
  - Reused that accent across shared picker rows and the custom
  selection-like surfaces that had drifted separately: picker tabs, hooks
  browsing, external-agent migration choices, and /keymap affordances.
  - Added focused tests for the light/dark accent rule and rendered
  selected-row styling.
  
  ## How to Test
  
  1. Start Codex in a terminal using a light background theme.
  2. Type `/` to open the slash-command picker and move the selection
  through a few rows.
  3. Confirm that the selected row is visibly colored with strong contrast
  instead of blending into the popup surface.
  4. Open `/keymap` and confirm the active tab, selected rows, and picker
  hint accents use the same light-theme accent treatment.
  5. In a dark terminal theme, repeat the slash-picker check and confirm
  the existing bright cyan selection styling is preserved.
  
  Targeted tests:
  - `cargo test -p codex-tui accent_style_uses_`
  - `cargo test -p codex-tui selected_rows_use_the_shared_accent_style`
  - `cargo test -p codex-tui
  selected_event_rows_use_the_shared_accent_style`
  
  Notes:
  - A full `cargo test -p codex-tui` run reached the end of the suite but
  hit an unrelated existing stack overflow in
  `tests::fork_last_filters_latest_session_by_cwd_unless_show_all`.

  Felipe Coury · 2026-05-09 16:10:56 -03:00
  53468b97f6
• fix(tui): preserve wrapped prose beside URLs (#21760)

  ## Why
  
  Mixed prose lines that contained URLs started taking the URL-preserving
  wrapping path, but that path could split ordinary words mid-token. A
  follow-up issue remained in scrollback insertion: when already-rendered
  indented rows were wrapped again, continuation rows could lose their
  margin and fall back to terminal hard wrapping. Together those bugs made
  normal Markdown output look broken around links, lists, blockquotes, and
  indented content.
  
  Separately, the local argument-comment lint wrappers failed under
  environments that set `PYTHONSAFEPATH=1`, because Python no longer adds
  the script directory to `sys.path` automatically. That prevented the
  lint from reaching Rust callsites at all.
  
  <img width="1778" height="1558" alt="CleanShot 2026-05-09 at 11 51 38"
  src="https://github.com/user-attachments/assets/9274d150-1757-4f1a-89ac-5bdc9997d8cb"
  />
  
  ## What Changed
  
  - Preserve URL tokens without turning every neighboring prose word into
  a character-level split point.
  - Add a mixed URL/prose wrapper that keeps ordinary words whole,
  preserves leading whitespace, and re-splits long non-URL tokens against
  the actual width available on continuation rows.
  - Reuse a rendered history row's leading whitespace as the continuation
  indent when scrollback insertion has to pre-wrap it again.
  - Add regression coverage for markdown wrapping, history-cell rendering,
  scrollback continuation margins, leading-indent width accounting, and
  continuation-row re-splitting.
  - Make both argument-comment lint entrypoints explicitly add their own
  directory to `sys.path`, so sibling imports still work when
  `PYTHONSAFEPATH=1`.
  
  ## How to Test
  
  1. Start Codex and render a long Markdown response that mixes prose with
  inline links, blockquotes, lists, and indented code-like text.
  2. Confirm that ordinary words next to links stay whole instead of
  breaking mid-word.
  3. Resize or replay the transcript and confirm wrapped continuation rows
  keep their expected left margin for blockquotes, lists, and indented
  content.
  4. Run the source argument-comment lint from a shell with
  `PYTHONSAFEPATH=1` and confirm it starts normally instead of failing to
  import `wrapper_common`.
  
  Targeted tests:
  - `cargo test -p codex-tui mixed_line --lib`
  - `cargo test -p codex-tui preserves_prefix_on_wrapped_rows --lib`
  - `cargo test -p codex-tui
  agent_markdown_cell_does_not_split_words_after_inline_markdown --lib`
  - `cargo test -p codex-tui
  mixed_url_markdown_wraps_prose_without_splitting_words_snapshot --lib`
  - `python3 tools/argument-comment-lint/test_wrapper_common.py`
  - `just argument-comment-lint-from-source -p codex-tui -- --lib`
  
  Notes:
  - `cargo test -p codex-tui` currently reaches the new tests
  successfully, then still aborts in the pre-existing
  `tests::fork_last_filters_latest_session_by_cwd_unless_show_all`
  stack-overflow failure.

  Felipe Coury · 2026-05-09 13:58:10 -03:00
  f27cf9db09
• [codex] Lowercase TUI service tier commands (#21906)

  ## Why
  
  Service-tier slash commands are built from model-catalog metadata. If
  the catalog returns a name like `Fast`, the TUI currently exposes
  `/Fast` and exact dispatch expects that casing, which is inconsistent
  with the lowercase command style used elsewhere.
  
  ## What
  
  - Lowercase service-tier command names when converting catalog tiers
  into `ServiceTierCommand` values.
  - Add regression coverage that seeds a catalog tier named `Fast` and
  expects the generated command to be `fast`.
  
  ## Testing
  
  Not run locally per repo instruction; PR CI should run the new
  `service_tier_commands_lowercase_catalog_names` coverage.

  Ahmed Ibrahim · 2026-05-09 14:29:12 +03:00
  fca81eeb5b
• [codex] request desktop attestation from app (#20619)

  ## Summary
  
  TL;DR: teaches `codex-rs` / app-server to request a desktop-provided
  attestation token and attach it as `x-oai-attestation` on the scoped
  ChatGPT Codex request paths.
  
  ![DeviceCheck attestation
  interface](https://raw.githubusercontent.com/openai/codex/dev/jm/devicecheck-diagram-assets/pr-assets/devicecheck-attestation-interface.png)
  
  ## Details
  
  This PR teaches the Codex app-server runtime how to request and attach
  an attestation token. It does not generate DeviceCheck tokens directly;
  instead, it relies on the connected desktop app to advertise that it can
  generate attestation and then asks that app for a fresh header value
  when needed.
  
  The flow is:
  
  1. The Codex desktop app connects to app-server.
  2. During `initialize`, the app can advertise that it supports
  `requestAttestation`.
  3. Before app-server calls selected ChatGPT Codex endpoints, it sends
  the internal server request `attestation/generate` to the app.
  4. app-server receives a pre-encoded header value back.
  5. app-server forwards that value as `x-oai-attestation` on the scoped
  outbound requests.
  
  The code in this repo is mostly protocol and runtime plumbing: it adds
  the app-server request/response shape, introduces an attestation
  provider in core, wires that provider into Responses / compaction /
  realtime setup paths, and covers the intended scoping with tests. The
  signed macOS DeviceCheck generation remains owned by the desktop app PR.
  
  ## Related PR
  
  - Codex desktop app implementation:
  https://github.com/openai/openai/pull/878649
  
  ## Validation
  
  <details>
  <summary>Tests run</summary>
  
  ```sh
  cargo test -p codex-app-server-protocol
  cargo test -p codex-core attestation --lib
  cargo test -p codex-app-server --lib attestation
  ```
  
  Also ran:
  
  ```sh
  just fix -p codex-core
  just fix -p codex-app-server
  just fix -p codex-app-server-protocol
  just fmt
  just write-app-server-schema
  ```
  
  </details>
  
  <details>
  <summary>E2E DeviceCheck validation</summary>
  
  First validated the signed desktop app boundary directly: launched a
  packaged signed `Codex.app`, sent `attestation/generate`, decoded the
  returned `v1.` attestation header, and validated the extracted
  DeviceCheck token with `personal/jm/verify_devicecheck_token.py` using
  bundle ID `com.openai.codex`. Apple returned `status_code: 200` and
  `is_ok: true`.
  
  Then ran the fuller app + app-server flow. The packaged `Codex.app`
  launched a current-branch app-server via `CODEX_CLI_PATH`, and a local
  MITM proxy intercepted outbound `chatgpt.com` traffic. The app-server
  requested `attestation/generate` from the real Electron app process, and
  the intercepted `/backend-api/codex/responses` traffic included
  `x-oai-attestation` on both routes:
  
  ```text
  GET  /backend-api/codex/responses  Upgrade: websocket  x-oai-attestation: present
  POST /backend-api/codex/responses  Upgrade: none       x-oai-attestation: present
  ```
  
  The captured header decoded to a DeviceCheck token that also validated
  with Apple for `com.openai.codex` (`status_code: 200`, `is_ok: true`,
  team `2DC432GLL2`).
  
  </details>
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Jiaming Zhang · 2026-05-08 12:36:02 -07:00
  5f4d0ec343
• Load configured environments from CODEX_HOME (#20667)

  ## Why
  
  The earlier PRs add stdio transport support and the config-backed
  environment provider, but the feature remains inert until normal Codex
  entrypoints construct `EnvironmentManager` with enough context to
  discover `CODEX_HOME/environments.toml`. This final stack PR activates
  the provider while preserving the legacy `CODEX_EXEC_SERVER_URL`
  fallback when no environments file exists.
  
  **Stack position:** this is PR 5 of 5. It is the product wiring PR that
  activates the configured environment provider added in PR 4.
  
  ## What Changed
  
  - Thread `codex_home` into `EnvironmentManagerArgs`.
  - Change `EnvironmentManager::new(...)` to load the provider from
  `CODEX_HOME`.
  - Preserve legacy behavior by falling back to
  `DefaultEnvironmentProvider::from_env()` when `environments.toml` is
  absent.
  - Make `environments.toml`-backed managers start new threads with all
  configured environments, default first, while keeping the legacy env-var
  path single-default.
  - Update the app-server, TUI, exec, MCP server, connector, prompt-debug,
  and thread-manager-sample callsites to pass `codex_home` and handle
  provider-loading errors.
  
  ## Self-Review Notes
  
  - The multi-environment startup path is intentionally tied to the
  `environments.toml` provider. Using `>1` configured environment as the
  only signal would also expand the legacy `CODEX_EXEC_SERVER_URL`
  provider because it keeps `local` addressable alongside `remote`.
  - The startup environment list is still derived inside
  `EnvironmentManager`; the provider only says whether its snapshot should
  start new threads with all configured environments.
  - The thread-manager sample was updated to pass the current
  `ThreadManager::new(...)` installation id argument so the stack compiles
  under Bazel.
  
  ## Stack
  
  - 1. https://github.com/openai/codex/pull/20663 - Add stdio exec-server
  listener
  - 2. https://github.com/openai/codex/pull/20664 - Add stdio exec-server
  client transport
  - 3. https://github.com/openai/codex/pull/20665 - Make environment
  providers own default selection
  - 4. https://github.com/openai/codex/pull/20666 - Add CODEX_HOME
  environments TOML provider
  - **5. This PR:** https://github.com/openai/codex/pull/20667 - Load
  configured environments from CODEX_HOME
  
  Split from original draft: https://github.com/openai/codex/pull/20508
  
  ## Validation
  
  - `just fmt`
  - `git diff --check`
  - `bazel build --config=remote --strategy=remote
  --remote_download_toplevel
  //codex-rs/thread-manager-sample:codex-thread-manager-sample`
  - `bazel test --config=remote --strategy=remote
  --remote_download_toplevel
  //codex-rs/exec-server:exec-server-unit-tests`
  - `bazel test --config=remote --strategy=remote
  --remote_download_toplevel --test_sharding_strategy=disabled
  --test_arg=default_thread_environment_selections_use_manager_default_id
  //codex-rs/core:core-unit-tests`
  - `bazel test --config=remote --strategy=remote
  --remote_download_toplevel --test_sharding_strategy=disabled
  --test_arg=start_thread_uses_all_default_environments_from_codex_home
  //codex-rs/core:core-unit-tests`
  
  ## Documentation
  
  This activates `CODEX_HOME/environments.toml`; user-facing documentation
  should be added before this stack is treated as a documented public
  workflow.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  starr-openai · 2026-05-08 11:17:56 -07:00
  5f2543b74e
• [codex] Generalize service tier slash commands (#21745)

  ## Why
  
  `/fast` was wired as a one-off slash command even though model metadata
  now exposes service tiers as catalog data. That meant adding another
  tier, such as a slower/cheaper tier, would require more hardcoded TUI
  plumbing instead of letting the model catalog drive the available
  commands.
  
  This change makes service-tier commands data-driven: each advertised
  `service_tiers` entry becomes a `/name` command using the catalog
  description, while the request path sends the tier `id` only when the
  selected model supports it.
  
  ## What Changed
  
  - Removed the hardcoded `/fast` slash-command variant and introduced
  dynamic service-tier command items in the composer and command popup.
  - Added toggle behavior for service-tier commands: invoking `/name`
  selects that tier, and invoking it again clears the selection.
  - Preserved the existing Fast-mode keybinding/status affordances by
  resolving the current model tier whose name is `fast`, while still
  sending the tier request value such as `priority`.
  - Persisted service-tier selections as raw request strings so non-fast
  tiers can round-trip through config.
  - Updated the Bedrock catalog entry to advertise fast support through
  `service_tiers` with `id: "priority"` and `name: "fast"`.
  - Added defensive filtering in core so unsupported selected service
  tiers are omitted from `/responses` requests.
  
  ## Validation
  
  - Added/updated coverage for dynamic service-tier slash command lookup,
  popup descriptions, composer dispatch, TUI fast toggling, and
  unsupported-tier omission in core request construction.
  - Local tests were not run per request.
  
  ---------
  
  Co-authored-by: Codex <noreply@openai.com>

  Ahmed Ibrahim · 2026-05-08 20:09:51 +03:00
  7c0e54bf59
• chore: thread tui (#21767)
  jif-oai · 2026-05-08 17:53:23 +02:00
  5b87bd2845
• api: send hyphenated session and thread headers (#21757)

  ## Why
  Some consumers expect conventional hyphenated HTTP headers. Codex
  already sends the session and thread IDs on outbound Responses requests,
  but it only uses the underscore spellings today, which makes those IDs
  harder to consume in systems that normalize or reject underscore header
  names.
  
  Full context here:
  https://openai.slack.com/archives/C08KCGLSPSQ/p1778248578422369
  
  ## What changed
  - `build_session_headers` now emits both `session_id` and `session-id`
  when a session ID is present.
  - It does the same for `thread_id` and `thread-id`.
  - Added regression coverage in `codex-api/tests/clients.rs` and
  `core/tests/suite/client.rs` so both the lower-level client tests and
  the end-to-end request tests assert the two header spellings are
  present.
  
  ## Test plan
  - Added header assertions in `codex-api/tests/clients.rs`.
  - Added request-header assertions in `core/tests/suite/client.rs` for
  both the `/v1/responses` and `/api/codex/responses` request paths.

  jif-oai · 2026-05-08 17:11:19 +02:00
  bd8fc9adb9
• Show permissions and approval mode in the TUI status line (#21677)

  Fixes #21665.
  
  ## Why
  
  The TUI status line is the right place for compact, glanceable session
  state. The original request was motivated by the need to see the active
  permission posture without opening `/permissions` or `/status`,
  especially when switching between safer and more permissive modes during
  a session.
  
  This PR intentionally separates `permissions` from `approval-mode`
  instead of combining them into one status-line item. They answer related
  but different questions: `permissions` describes the active
  sandbox/profile shape, while `approval-mode` describes how command
  approvals are handled. Keeping them separate makes each item
  independently configurable and avoids long combined labels in an already
  space-constrained status line.
  
  The tradeoff is that users who want the full permission posture in the
  status line need to opt into both items. In exchange, users can show
  only the sandbox/profile label, only the approval behavior, or both, and
  named user-defined profiles remain concise. Non-standard permission
  shapes are rendered as `Custom permissions` rather than trying to
  squeeze detailed profile contents into the status line; `/status`
  remains the fuller explanatory surface.
  
  ## What changed
  
  - Added a configurable `permissions` status-line item.
  - Added a separate `approval-mode` status-line item, with `approval` as
  an alias.
  - Render standard permission states compactly as `Read Only`,
  `Workspace`, or `Full Access`.
  - Preserve user-defined permission profile names directly in the status
  line.
  - Render unnamed non-standard permission shapes as `Custom permissions`.
  - Refresh status surfaces when `/permissions` updates the permission
  profile, approval policy, or approval reviewer.
  - Updated status-line preview snapshot coverage for the new items.
  
  ## Verification
  
  - `cargo test -p codex-tui
  status_permissions_non_default_workspace_write_uses_workspace_label`
  - `cargo test -p codex-tui
  permissions_selection_emits_history_cell_when_selection_changes`
  - `cargo insta pending-snapshots --manifest-path tui/Cargo.toml`

  Eric Traut · 2026-05-08 08:03:11 -07:00
  e6312d44f0
• Display blended token count in status line (#21669)

  ## Why
  
  The configurable `/statusline` and terminal title can display session
  token usage. That display was using the raw total token count, which
  includes cached input tokens, so it significantly overstated the token
  usage compared with the blended token count shown elsewhere (in
  `/status` and tracked in goals). This inconsistency resulted in user
  confusion. We don't want to report cached tokens because we don't charge
  for them and they are somewhat of an implementation detail that users
  shouldn't care about.
  
  ## What changed
  
  - Use `TokenUsage::blended_total()` for the `used-tokens` status surface
  item so cached input is excluded.
  - Add a brief comment to `tokens_in_context_window()` clarifying that it
  returns raw `total_tokens`, whose meaning depends on whether the caller
  has last-turn or accumulated usage.

  Eric Traut · 2026-05-08 07:56:13 -07:00
  f86d95a242
• Update models.json (#19896)

  Automated update of models.json.
  
  ---------
  
  Co-authored-by: aibrahim-oai <219906144+aibrahim-oai@users.noreply.github.com>
  Co-authored-by: Ahmed Ibrahim <aibrahim@openai.com>

  github-actions[bot] · 2026-05-08 17:41:55 +03:00
  aadcae9f3c
• Remove skills list extra roots (#21485)

  ## Summary
  - Remove `perCwdExtraUserRoots` / `SkillsListExtraRootsForCwd` from the
  `skills/list` app-server API.
  - Drop Rust app-server and `codex-core-skills` extra-root plumbing so
  skill scans are keyed by the normal cwd/user/plugin roots only.
  - Regenerate app-server schemas and update docs/tests that only existed
  for the removed extra-roots behavior.
  
  ## Validation
  - `just write-app-server-schema`
  - `just fmt`
  - `cargo test -p codex-app-server-protocol`
  - `cargo test -p codex-core-skills`
  - `just fix -p codex-app-server-protocol`
  - `just fix -p codex-core-skills`
  - `just fix -p codex-app-server`
  - `just fix -p codex-tui`
  
  ## Notes
  - `cargo test -p codex-app-server --test all skills_list` ran the edited
  skills-list cases, but the full filtered run ended on existing
  `skills_changed_notification_is_emitted_after_skill_change` timeout
  after a websocket `401`.
  - `cargo test -p codex-tui --lib` compiled the changed TUI callers, then
  failed two unrelated status permission tests because local
  `/etc/codex/requirements.toml` forbids `DangerFullAccess`.
  - Source-truth check found the OpenAI monorepo still has
  generated/app-server-kit mirror references to the removed field; those
  should be cleaned up when generated app-server types are synced or in a
  companion OpenAI cleanup.

  xli-oai · 2026-05-07 20:56:42 -07:00
  314229fd72
• [codex-analytics] plumb protocol-native review timing (#21434)

  ## Why
  
  We want terminal tool review analytics, but the reducer should not stamp
  review timing from its own wall clock.
  
  This PR plumbs review timing through the real protocol and app-server
  seams so downstream analytics can consume the emitter's timestamps
  directly. Guardian reviews keep their enriched `started_at` /
  `completed_at` analytics fields by deriving those legacy second-based
  values from the same protocol-native millisecond lifecycle timestamps,
  rather than sampling a separate analytics clock.
  
  ## What changed
  
  - add `started_at_ms` to user approval request payloads
  - add `started_at_ms` / `completed_at_ms` to guardian review
  notifications
  - preserve Guardian review `started_at` / `completed_at` enrichment from
  the protocol-native timing source
  - stamp typed `ServerResponse` analytics facts with app-server-observed
  `completed_at_ms`
  - thread the new timing fields through core, protocol, app-server, TUI,
  and analytics fixtures
  
  ## Verification
  
  - `cargo test -p codex-app-server outgoing_message --manifest-path
  codex-rs/Cargo.toml`
  - `cargo test -p codex-app-server-protocol guardian --manifest-path
  codex-rs/Cargo.toml`
  - `cargo test -p codex-tui guardian --manifest-path codex-rs/Cargo.toml`
  - `cargo test -p codex-analytics analytics_client_tests --manifest-path
  codex-rs/Cargo.toml`
  
  ---
  [//]: # (BEGIN SAPLING FOOTER)
  Stack created with [Sapling](https://sapling-scm.com). Best reviewed
  with [ReviewStack](https://reviewstack.dev/openai/codex/pull/21434).
  * #18748
  * __->__ #21434
  * #18747
  * #17090
  * #17089
  * #20514

  rhan-oai · 2026-05-07 20:31:41 -07:00
  99016ec732
• Disable empty Cargo test targets (#21584)

  ## Summary
  
  `cargo test` has entails both running standard Rust tests and doctests.
  It turns out that the doctest discovery is fairly slow, and it's a cost
  you pay even for crates that don't include any doctests.
  
  This PR disables doctests with `doctest = false` for crates that lack
  any doctests.
  
  For the collection of crates below, this speeds up test execution by
  >4x.
  
  E.g., before this PR:
  
  ```
  Benchmark 1: cargo test     -p codex-utils-absolute-path     -p codex-utils-cache     -p codex-utils-cli     -p codex-utils-home-dir     -p codex-utils-output-truncation     -p codex-utils-path     -p codex-utils-string     -p codex-utils-template     -p codex-utils-elapsed     -p codex-utils-json-to-toml
    Time (mean ± σ):      1.849 s ±  4.455 s    [User: 0.752 s, System: 1.367 s]
    Range (min … max):    0.418 s … 14.529 s    10 runs
  ```
  
  And after:
  
  ```
  Benchmark 1: cargo test     -p codex-utils-absolute-path     -p codex-utils-cache     -p codex-utils-cli     -p codex-utils-home-dir     -p codex-utils-output-truncation     -p codex-utils-path     -p codex-utils-string     -p codex-utils-template     -p codex-utils-elapsed     -p codex-utils-json-to-toml
    Time (mean ± σ):     428.6 ms ±   6.9 ms    [User: 187.7 ms, System: 219.7 ms]
    Range (min … max):   418.0 ms … 436.8 ms    10 runs
  ```
  
  For a single crate, with >2x speedup, before:
  
  ```
  Benchmark 1: cargo test -p codex-utils-string
    Time (mean ± σ):     491.1 ms ±   9.0 ms    [User: 229.8 ms, System: 234.9 ms]
    Range (min … max):   480.9 ms … 512.0 ms    10 runs
  ```
  
  And after:
  
  ```
  Benchmark 1: cargo test -p codex-utils-string
    Time (mean ± σ):     213.9 ms ±   4.3 ms    [User: 112.8 ms, System: 84.0 ms]
    Range (min … max):   206.8 ms … 221.0 ms    13 runs
  ```
  
  Co-authored-by: Codex <noreply@openai.com>

  Charlie Marsh · 2026-05-07 15:44:17 -07:00
  54ef99a365
• Show plugin hooks in plugin details (#21447)

  Supersedes the abandoned #19859, rebuilt on latest `main`.
  
  # Why
  
  PR #19705 adds discovery for hooks bundled with plugins, but `/plugins`
  still only shows skills, apps, and MCP servers. This follow-up makes
  bundled hooks visible in the same plugin detail view so users can
  inspect the full plugin surface in one place.
  
  We also need `PluginHookSummary` to populate Plugin Hooks in the app;
  `hooks/list` is not enough there because plugin detail needs to show
  hooks for disabled plugins too.
  
  # What
  
  - extend `plugin/read` with `PluginHookSummary` entries for bundled
  hooks
  - summarize plugin hooks while loading plugin details
  - render a `Hooks` row in the `/plugins` detail popup
  
  <img width="3456" height="848" alt="CleanShot 2026-04-27 at 11 45 34@2x"
  src="https://github.com/user-attachments/assets/fe3a38d6-a260-4351-8513-fb04c93d725b"
  />

  Abhinav · 2026-05-07 00:21:14 -07:00
  40e282849c
• Revert state DB injection and agent graph store (#21481)

  ## Why
  
  Reverts #20689 to restore the previous optional state DB plumbing. The
  conflict resolution keeps the newer installation ID and session/thread
  identity changes that landed after #20689, while removing the mandatory
  state DB and agent graph store dependency from ThreadManager
  construction.
  
  ## What changed
  
  - Restored `Option<StateDbHandle>` through app-server, MCP server,
  prompt debug, and test entry points.
  - Removed the `codex-core` dependency on `codex-agent-graph-store` and
  reverted descendant lookup back to the existing state DB path when
  available.
  - Kept newer `installation_id` forwarding by passing it beside the
  optional DB handle.
  - Kept local thread-name updates working when the optional state DB
  handle is absent.
  
  ## Validation
  
  - `git diff --check`
  - `cargo test -p codex-thread-store`
  - `cargo test -p codex-state -p codex-rollout -p
  codex-app-server-protocol`
  - Attempted `env CARGO_INCREMENTAL=0 cargo test -p codex-core -p
  codex-app-server -p codex-app-server-client -p codex-mcp-server -p
  codex-thread-manager-sample -p codex-tui`; blocked locally by a rustc
  ICE while compiling `v8 v146.4.0` with `rustc 1.93.0 (254b59607
  2026-01-19)` on `aarch64-apple-darwin`.

  pakrym-oai · 2026-05-06 22:48:29 -07:00
  a8488fec5e
• fix(tui): clear first inline viewport render (#21450)

  ## Why
  
  The alpha TUI can render the initial trust-directory prompt with stale
  terminal text showing through spaces when startup begins below existing
  shell output. The first inline viewport transition can happen while the
  previous viewport is still empty, so the old clear path no-ops before
  Ratatui draws the prompt. Ratatui then skips blank cells because its
  previous buffer also thinks those cells are blank, leaving old terminal
  contents visible inside the prompt.
  
  ## What Changed
  
  - Clear from the new inline viewport top when the previous viewport is
  empty during a viewport transition.
  - Keep the existing clear-from-old-viewport behavior for normal viewport
  updates.
  - Add a VT100-backed regression test that pre-fills terminal contents,
  performs the first viewport clear, and verifies stale text inside the
  new viewport is removed while shell content above the viewport remains.
  
  ## How to Test
  
  1. Start Codex alpha in a terminal that already has visible shell output
  above the cursor.
  2. Use a fresh untrusted project directory so the trust-directory prompt
  appears.
  3. Confirm the prompt text renders cleanly, with spaces staying blank
  instead of showing fragments of previous shell output.
  4. As a regression check, confirm content above the inline viewport is
  still preserved in terminal scrollback.
  
  Targeted tests:
  - `cargo test -p codex-tui
  first_viewport_change_clears_from_new_viewport_when_old_viewport_is_empty
  -- --nocapture`
  - `cargo test -p codex-tui`

  Felipe Coury · 2026-05-07 02:48:49 +00:00
  5a4b2702f2
• Add compact lifecycle hooks (started by vincentkoc - external contrib) (#19905)

  Based on work from Vincent K -
  https://github.com/openai/codex/pull/19060
  
  <img width="1836" height="642" alt="CleanShot 2026-04-29 at 20 47 40@2x"
  src="https://github.com/user-attachments/assets/b647bb89-65fe-40c8-80b0-7a6b7c984634"
  />
  
  ## Why
  
  Compaction rewrites the conversation context that future model turns
  receive, but hooks currently have no deterministic lifecycle point
  around that rewrite. This adds compact lifecycle hooks so users can
  audit manual and automatic compaction, surface hook messages in the UI,
  and run post-compaction follow-up without overloading tool or prompt
  hooks.
  
  ## What Changed
  
  - Added `PreCompact` and `PostCompact` hook events across hook config,
  discovery, dispatch, generated schemas, app-server notifications,
  analytics, and TUI hook rendering.
  - Added trigger matching for compact hooks with the documented `manual`
  and `auto` matcher values.
  - Wired `PreCompact` before both local and remote compaction, and
  `PostCompact` after successful local or remote compaction.
  - Kept compact hook command input to lifecycle metadata: session id,
  Codex turn id, transcript path, cwd, hook event name, model, and
  trigger.
  - Made compact stdout handling consistent with other hooks: plain stdout
  is ignored as debug output, while malformed JSON-looking stdout is
  reported as failed hook output.
  - Added integration coverage for compact hook dispatch, trigger
  matching, post-compact execution, and the audited behavior that
  `decision:"block"` does not block compaction.
  
  ## Out of Scope
  
  - Hook-specific compaction blocking is not implemented;
  `decision:"block"` and exit-code-2 blocking semantics are intentionally
  unsupported for `PreCompact`.
  - Custom compaction instructions are not exposed to compact hooks in
  this PR.
  - Compact summaries, summary character counts, and summary previews are
  not exposed to compact hooks in this PR.
  
  ## Verification
  
  - `cargo test -p codex-hooks`
  - `cargo test -p codex-core
  manual_pre_compact_block_decision_does_not_block_compaction`
  - `cargo test -p codex-app-server hooks_list`
  - `cargo test -p codex-core config_schema_matches_fixture`
  - `cargo test -p codex-tui hooks_browser`
  
  ## Docs
  
  The developer documentation for Codex hooks should be updated alongside
  this feature to document `PreCompact` and `PostCompact`, the
  `manual`/`auto` matcher values, and the compact hook payload fields.
  
  ---------
  
  Co-authored-by: Vincent Koc <vincentkoc@ieee.org>

  Andrei Eternal · 2026-05-06 18:08:31 -07:00
  527d52df03
• feat: Add marketplace source filtering and plugin share context (#21419)

  Adds marketplaceKinds to plugin/list for local, workspace-directory, and
  shared-with-me; omitted params keep default local plus gated global
  behavior, while explicit kinds are exact.
  
  Exposes shareContext on plugin summaries from local share mappings and
  remote workspace/shared responses, including remotePluginId and nullable
  creator metadata.
  
  Adds shared-with-me listing through /ps/plugins/workspace/shared,
  renames the workspace remote namespace to workspace-directory, and keeps
  direct remote read/share/install/update/delete paths gated by plugins
  rather than remote_plugin.

  xl-openai · 2026-05-06 16:12:23 -07:00
  11106016ff
• [codex-tui] pass thread source for tui threads (#21401)

  ## Summary
  - mark TUI-created thread starts and forks with explicit `thread_source
  = user`
  - add focused coverage for embedded and remote lifecycle request
  builders
  
  ## Why
  Thread analytics now consume an explicit thread-level source
  classification instead of inferring it from `session_source`. The TUI
  still omitted that field, so TUI-created interactive threads would
  continue to land as `null` even after the new analytics plumbing
  shipped.
  
  ## Validation
  - `cargo test -p codex-tui app_server_session --lib`

  rhan-oai · 2026-05-06 13:18:41 -07:00
  21295f47e2
• [codex] Dedupe fallback model metadata warnings (#21090)

  Fixes #21070.
  
  This is a small cleanup around model metadata handling for
  gateway/provider model names. It follows the report and proposed
  direction from @dkbush by keeping the fallback metadata warning useful
  without repeating it every turn, and by tightening the existing
  provider-prefix lookup path.
  
  - Track fallback metadata warning slugs in session state so each
  unresolved model warns once per session.
  - Keep warning emission outside the session-state lock and preserve the
  existing warning text.
  - Allow one-segment provider prefixes with hyphenated provider IDs,
  while preserving the multi-segment rejection behavior.
  - Add focused coverage for warning dedupe and hyphenated provider-prefix
  metadata matching.
  
  Testing:
  
  - Ran `just fmt`.
  - Ran `git diff --check`.
  - Added tests for the new warning dedupe and provider-prefix lookup
  behavior.

  canvrno-oai · 2026-05-06 13:11:44 -07:00
  d5f0b6d63a
• Route opted-in MCP elicitations through Guardian (#19431)

  # Motivation
  
  Browser Use origin-access prompts are MCP elicitations, not direct
  tool-call approval prompts, so they were bypassing the Guardian approval
  path. We need a generic opt-in that lets eligible MCP elicitations use
  Guardian when the current turn already routes approvals there.
  
  # Description
  
  Add a generic elicitation reviewer hook in codex-mcp and wire codex-core
  to pass a Guardian reviewer callback when creating the MCP connection
  manager. The reviewer validates explicit mcp_tool_call opt-in metadata,
  builds a Guardian MCP tool-call review request from
  server/tool/connector metadata and tool params, and maps Guardian
  approval, denial, timeout, and cancellation decisions back to MCP
  elicitation responses.
  
  The new option to trigger this in the `_meta` object is:
  ```
  "codex_request_type": "approval_request",
  ```
  
  # Testing
  
  - RUST_MIN_STACK=8388608 NEXTEST_STATUS_LEVEL=leak cargo nextest run
  --no-fail-fast --cargo-profile ci-test --test-threads 2
  - cargo clippy --tests -- -D warnings
  - cargo fmt -- --config imports_granularity=Item --check
  - cargo shear
  - pnpm run format
  - python3 .github/scripts/verify_cargo_workspace_manifests.py
  - python3 .github/scripts/verify_tui_core_boundary.py
  - python3 .github/scripts/verify_bazel_clippy_lints.py
  - git diff --check

  Clark DuVall · 2026-05-06 19:42:45 +00:00
  346070a424
• fix(tui): persist ctrl-c draft via app event (#21397)

  ## Why
  
  The main branch started failing after #21351 merged because the merge
  commit kept calling `AppCommand::add_to_history` from
  `BottomPane::clear_composer_for_ctrl_c`, but main had already removed
  that helper as part of the history persistence refactor. The PR head
  passed because it was based on an older main commit where the helper
  still existed.
  
  This restores the Ctrl+C draft-stashing behavior using the current
  app-event path instead of the removed command helper.
  
  ## What Changed
  
  - Store the active `ThreadId` in `BottomPane` when history metadata is
  provided.
  - Emit `AppEvent::AppendMessageHistoryEntry` for Ctrl+C-cleared drafts.
  - Update the slash-clear regression test to assert the current history
  event shape.
  
  ## How to Test
  
  Targeted tests:
  - `cargo test -p codex-tui
  slash_clear_after_ctrl_c_keeps_stashed_draft_recallable`
  
  Broader local checks:
  - `just fix -p codex-tui`
  - `just argument-comment-lint -p codex-tui`
  - `git diff --check origin/main...HEAD`
  - `cargo test -p codex-tui` reached completion; the fixed test passed,
  and the only local failures were
  `status::tests::status_permissions_full_disk_managed_*`, blocked by this
  machine config rejecting `DangerFullAccess` via
  `/etc/codex/requirements.toml`.

  Felipe Coury · 2026-05-06 19:03:11 +00:00
  6b7d6cafa0
• fix(tui): keep Ctrl-C stashed drafts after /clear (#21351)

  ## Why
  
  When a user stashes a draft with Ctrl+C, then runs `/clear`, the fresh
  chat session loses the in-memory composer history that held the stashed
  draft. Pressing Up after `/clear` can then recall an older submitted
  prompt instead of the draft the user explicitly saved for later.
  
  ## What Changed
  
  - Record Ctrl+C-cleared composer text through the existing message
  history path, so it survives the fresh session created by `/clear`.
  - Keep `/clear` itself out of local slash-command recall so it does not
  sit ahead of the stashed draft.
  - Add regression coverage for the full flow: submit a prompt, stash a
  later draft with Ctrl+C, run `/clear`, then recall the stashed draft
  before the older prompt.
  
  ## How to Test
  
  1. Start Codex with `just c`.
  2. Submit a short prompt such as `ok` and wait for the turn to complete.
  3. Type a new draft, press Ctrl+C, then run `/clear`.
  4. Press Up and confirm the stashed draft is restored.
  5. Press Up again and confirm the older submitted prompt is still
  reachable after the stashed draft.
  
  Targeted tests:
  
  - `cargo test -p codex-tui
  slash_clear_after_ctrl_c_keeps_stashed_draft_recallable`
  
  Manual verification:
  
  - Reproduced the issue in tmux with `RUST_LOG=trace just c -c
  log_dir=...`: before the fix, Up after `/clear` recalled the older
  submitted prompt.
  - Re-tested the same tmux flow after the fix: Up after `/clear` restored
  the Ctrl+C-stashed draft.

  Felipe Coury · 2026-05-06 14:46:18 -03:00
  e97610cf3b